Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method · GHSA-hp74-gm6m-2qm5 · GitHub Advisory Database · GitHub

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Moderate severity GitHub Reviewed Published Apr 26, 2026 in pocket-id/pocket-id

0 Open 0 Closed

No closed alerts for this advisory

Give feedback on Dependabot alerts